SQL injection in FoxCMS up to 1.2.5 allows authenticated remote attackers to execute arbitrary SQL commands via the 'ids' parameter in the batchCope function of Download.php. A public exploit is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.07%), suggesting limited exploitation risk.
A security vulnerability in PingFederate OAuth2 grant duplication in PostgreSQL persistent storage (CVSS 2.1) that allows oauth2 requests. Remediation should follow standard vulnerability management procedures.
Stored cross‑site scripting in ComfyUI’s /upload/image endpoint allows unauthenticated, remote attackers to inject arbitrary web scripts by uploading a crafted image. The flaw exists in all versions up to 0.3.39 and is an incomplete fix of CVE‑2024‑10099. Public exploit code is available, though no active exploitation has been reported.
Open redirect vulnerability in Astun Technology iShare Maps 5.4.0 via the ref parameter in atCheckJS.aspx allows remote attackers to redirect users to arbitrary external sites, facilitating phishing attacks. Publicly available exploit code exists, though active exploitation has not been confirmed. The vendor was contacted but did not respond.